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Application No. 
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Applicant(s) 

LADWIG, MICHAEL D. 


Examiner 

Bryce P Bonzo 


Art Unit 

2184 





- The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )^ Responsive to communication(s) filed on 03 September 2003 . 
2a)S This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1935 CD. 1 1, 453 O.G. 213. 
Disposition of Claims 

4) |SI Claim(s) 1,2,4-6,8,15-20,22-25,31,32 and 263 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) __ is/are allowed. 

6) Q Claim(s) is/are rejected. 

7) ^ Claim(s) 7 and 30 is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
1 !)□ The proposed drawing correction filed on is: a)D approved b)D disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a)0 All b)D Some*c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2.D Certified copies of the priority documents have been received in Application No. . 



3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) ^ Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 
Attachment(s) 



1) |2S] Notice of References Cited (PTO-892) 

2) O Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) O Information Disclosure Statement(s) (PTO-1449) Paper No(s) . 



4) Q Interview Summary (PTO-413) Paper No(s). 

5) □ Notice of Informal Patent Application (PTO-1 52) 

6) D Other: 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 04-01) 
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FINAL REJECTION 



Status of the Clams 



Claims 1 , 2, 4-8, 14-20, 22-24, 26-27, 21 and 32 are rejected under Double Patenting. 
Claims 1 ,4-6, 8, 14-19, 22, 24, 26, 28 and 29 are rejected under 35 USC §102. 
Claims 2, 14, 20, 23, 25 and 27 are rejected under 35 USC §1 03(a). 
Claim 7 and 30 are objected to while containing allowable matter. 



The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. See In re Goodman, 11 
F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 
USPQ645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 
1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970);and, In re Thorington, 
418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) may be 
used to overcome an actual or provisional rejection based on a nonstatutory double 
patenting ground provided the conflicting application or patent is shown to be commonly 
owned with this application. See 37 CFR 1 .130(b). 

Effective January 1, 1994, a registered attorney or agent of record may sign a 
terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 
37 CFR 3.73(b). 

Claims 1,2, 4-8, 14-20, 22-24 and 26-27 are rejected under the judicially created 
doctrine of obviousness-type double patenting as being unpatentable over claims 1-33 
of U.S. Patent No. 6,408,404. Although the conflicting claims are not identical, they are 



Obvious-type Double Patenting 



not patentably distinct from each other. 
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Claims 1-33 of United States Patent No. 6,408,404 do not recite claim the 
direction by the presence found in claims 1, 2, 4-8, 14-20, 22-24 and 26-27 of the 
pending application. In a computer system designed to gather large amounts of varied 
data it is well known in the art guide the gathering of data so as to gather only the data 
needed. This is due to the sheer the quantity of data on a network. When a system 
attempts to simple gather all data it can often become overloaded and begin to miss 
needed data. Thus it would have been obvious to one of ordinary skill in the art at the 
time of invention to implement the direction by the presence such as passing the 
parameters of a filter to a gatherer in order ensure the needed data is gathered. 

Claims 20-33 of United States Patent No. 6,408,404 do not recite claim the 
requirement for heterogeneous dafa found in claims 1,2, 4-8, 14-20, 22-24 and 26-27 of 
the pending application. Network data is well known to be a heterogeneous mix of 
information ranging from IP addresses, ECC coding, time stamps and other items. 
Thus it would have been obvious to one of ordinary skill in the art to data that was 
heterogeneous in nature, as the network itself transmits data in a heterogeneous form. 
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Rejections under 35 USC §102 



The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
the invention by the applicant for patent, except that an international application filed under 
the treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21 (2) of such treaty in the English language. 

Claims 1, 2, 4, 8 and 15-19 are rejected under 35 U.S.C. 102(e) as being 
anticipated by McCreery. 

As per claim 1 , McCreery discloses: 

gathering heterogeneous data (column 4, lines 48-63; column 5, lines 1-10), as 
directed by the presence (column 4, lines 55-56; column 4, lines 45-47 means to 
configure a filter) at two or more remote computers (column 4, lines 8-18) and placing 
the gathered data in a data stream and forwarding the data stream to the presence 
(column 4, lines 63-65). 

receiving at least one data stream at a computer, the data stream including data 
representative of events (column 4, lines 41-43 and 58-67); 

applying rules to the data stream for sorting data representative of events and for 
taking an action based on a specific event (column 4, lines 44-57). 

As per claim 4, McCreery discloses: wherein said gathering step is performed by 
an agent (column 4, lines 35-63 the network interface is an agent as it works on behalf 
of the analyzer). 
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As per claim 5, McCreery discloses: hunting for predetermined data at a remote 
location and placing the hunted data in a data stream and forwarding the data stream to 
the computer (the IP addresses of packets filtered by McCreery contain data stored at a 
remote location). 

As per claim 6, McCreery discloses: the hunting is carried out by agents (column 
4, lines 35-63 the network interface is an agent as it works on behalf of the analyzer). 

As per claim 8, McCreery discloses: wherein the at least one data stream 
includes message traffic (column 2, lines 1 1-20). 

As per claim 1 5, McCreery discloses: wherein an event is comprised of at least 
one of the following elements: types, title, datetime, keywords, summary priority and 
duration (Figure 5b-1). 

As per claim 16, McCreery discloses: wherein a rule includes a criteria 
component and an action component (column 5, lines 47-57: Action-"notification", 
Criteria: "exceeds predetermined thresholds"). 

As per claim 17, McCreery discloses: wherein the criteria component includes at 
least one criteria statement and to satisfy a rule either all, any or none of the at least 
one criteria statements need to be satisfied. As McCreery shows, once the network 
exceeds a threshold (satisfies a rule criteria) action is takes (column 5, lines 52-57). 

As per claim 18, McCreery discloses: at least one action is taken if the at least 
one rule is satisfied (column 5, lines 43-57). 
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As per claim 19, McCreery discloses: wherein the data in the event data stream 
is received jn a standardized format (Figure 5c, Ethernet format). 

Claim 22 is rejected in the manner of claim 1, as claim 22 is the article of 
manufacture embodiment of the method claim 1 . 

Claim 24 is rejected in the manner of claim 1, as claim 24 is the computer 
architecture embodiment of method claim 1. 

Claim 26 is rejected in the manner of claim 1 , as claim 26 is the computer system 
embodiment of method claim 1 . 

As per claim 28, McCreery discloses: 

wherein said gathering step includes collecting/gathering data at two or more 
remote computes (column 6, lines 41-46). 
As per claim 29, McCreery discloses: 

wherein said gathering and receiving step are preformed in real-time. McCreery 
discloses the use of a hardware device (that is a network device in promiscuous mode) 
taking data off of a network. As the network device is operating at a high speed and 
immediately processing the network data s soon as it is placed on the network, it is a 
real-time system. 

As per claim 31 , McCreery discloses: 

wherein the action is automatically brought to the attention of the user (column 5, 
line 51). 
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As per claim 32, McCreery discloses: 

wherein alert including one of an alert window, flashing icon, email and beeper 
notification is used automatically (column 7, lines 1-6). 

Rejections under 35 USC §1 03(a) 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

Claims 2, 14, 20, 23, 25, 27 and 29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over McCreery. 

As per dependant claim 2, McCreery does not explicitly teach displaying the 
events in a timeline. McCreery does disclose the gathering and formatting of the 
information required to generate a timeline. Further, McCreery does specifically 
discloses the data is used to generate charts and graphs. Additionally, McCreery 
teaches the display of data in chronological order (Figures 5 and 7). A timeline provides 
easy user access to information in chronological order. Thus it would have been 
obvious to one of ordinary skill in the art at the time of invention to use the gathered 
information of McCreery to display a timeline. 

As per claim 14, McCreery does not explicitly disclose: filing (storing) the sorted 
information in separate data stream files. McCreery does store data which has been 
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modified and raw data, however does state that the data is stored separately. Given 
the purpose of creating the modified data is to "avoid redundant storage of the same 
data" (column 5, lines 30-35). Therefore it is clear McCreery is storing multiple sets of 
data. Thus it would have been obvious to one of ordinary skill in the art at the time of 
invention to store the sorted information separately from other information thus allowing 
easy access to the filtered information. 

As per claim 20, McCreery discloses: displaying an event stream using 
information stored in stored stream files (column 5, lines 31-43, Figures 5). 

Claim 23 is rejected in the manner of claim 2, as claim 23 is the article 
embodiment of the method claim 2. 

Claim 27 is rejected in the manner of claim 2, as claim 27 is the computer system 
embodiment of method claim 2. 

As per claim 29, McCreery discloses: 

wherein said gathering and receiving step are preformed in real-time. McCreery 
discloses the use of a hardware device (that is a network device in promiscuous mode) 
taking data off of a network. As the network device is operating at a high speed and 
immediately processing the network data s soon as it is placed on the network, it is a 
real-time system. 
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Allowable Matter 

Claim 7 is objected to while containing allowable matter. 

The following is a statement of reasons for the indication of allowable subject 
matter: McCreery does not disclose: normalizing data before the data is placed in the 
stream in combination with all the remaining limitations of the claims. 

Claim 30 is objected to while containing allowable matter. McCreery does not 
disclose the changing of the filtering of the data based on an event, based on the 
analysis of the data. 

Applicant is reminded that claims are indicated as containing allowable matter 
with respect to the claim a whole and any change to the scope of the claim may 
jeopardize this indication of allowable matter. 

Response to Applicant 

First Applicant did not fully respond to the Official Action of 6/4/03. Applicant 
omitted ant reference to the Obvious-type Double Patenting rejection presented in the 
preceding Non-Final Official Action. 

Second, Applicant has challenged the Examiner's use of Official Notice regarding 
the displaying of timelines in alert systems. The Examiner provides United States 
Patent No. 6,223,143 to Weinsock et al. as support that displaying fault or alert data is 
from data streams is notoriously well known in the art, and provides an example as to 
why such systems are used (safety systems for mission critical devices such as the 
space shuttle). 



• 
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Third, Applicant has argued that McCreery does not disclose events. The 
Examiner views each receipt of packets as an event. 

Fourth, Applicant added 3 dependent claims. One was indicated as containing 
allowable matter, while two were further rejected under 35 USC §102. 

Final Disposition 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 



TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Bryce P Bonzo whose telephone number is (703)305- 
4834. The examiner can normally be reached on Monday through Friday from 5:30AM 
to 2:00PM. 



Conclusion 



% • 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Robert Beausoliel, can be reached on (703) 305-9713. For facsimile 
transmission: 

After-final (703) 746-7238 

Official (703) 746-7239 

Non-Official/Draft (703) 746-7240 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 
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